Compliance in the Cloud

If we are moving into the cloud, we want to be sure that we can extend our compliance to the cloud. If we have data under most privacy legislation, if we have something that classes as personally identifiable data, and under the GDPR, bear in mind, this could be a telephone number, an email address. What constitutes personally identifiable information is very broad. So this responsibility sits with the person collecting the data, the data controller. If you have this data and you store it in the cloud, and the cloud provider fails, whose responsibility is it? Still your responsibility. So this is really important to understand.

Without cloud services, we have some restrictions that arise legally through legislation like GDPR that mean we cannot store personally identifiable information outside of a particular jurisdiction. So with the European Union and GDPR, you cannot store PII outside of the GDPR area unless there are equivalent protections provided as we described earlier in the course. So we need to understand, where is the cloud? Where is that data stored? And this is a big question. With big international companies like Microsoft, Google, Amazon, where are their data centres? Where are the administrators of those data centres? So the low cost of cloud is very attractive, but we have a very low visibility of how these services are maintained sometimes.

Some of these services, from an identity and access management perspective, and also from a security governance perspective, many of these services are very low-cost to initiate, and so remain very low-visible within, have a very low level of visibility within our organizations. So when we’re using these services, corporately, we may have good governance. But increasingly, what you’ll see is these arising through much more iterative use by employees, where employees just decide to start using something like Slack or Dropbox. So we need to make sure we can extend our governance locally to cover cloud services, that we manage procurement of cloud services, and also that any services we buy are compliant with whatever requirements we have.

Noncompliance becomes really easy with cloud services, and it can be accomplished without any awareness. You may not know what some of your users are doing with your data.